{"record":{"id":"d4728429cca2ec2e","repo":"BerriAI/litellm","slug":"push-notification-url-must-use-https","errorCode":null,"errorMessage":"Push notification URL must use HTTPS","messagePattern":"Push notification URL must use HTTPS","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/agent_endpoints/a2a_endpoints.py","lineNumber":100,"sourceCode":"def _served_version(agent: \"AgentResponse\", request: Request, original_method: str | None = None) -> A2AVersion:\n    \"\"\"Protocol version LiteLLM serves for this agent.\n\n    The agent's configured version governs. For agents that pin no version, fall back\n    to the client's signal: PascalCase JSON-RPC methods and an ``a2a-version: 1.x``\n    header both mark a 1.0 caller; otherwise default to 0.3.\n    \"\"\"\n    configured: Final = (agent.agent_card_params or {}).get(\"protocolVersion\")\n    if configured in (\"0.3\", \"1.0\"):\n        return configured\n    if original_method in _PASCAL_TO_WIRE:\n        return \"1.0\"\n    return \"1.0\" if request.headers.get(\"a2a-version\", \"\").startswith(\"1.\") else \"0.3\"\n\n\ndef _validate_push_notification_url(url: str) -> None:\n    parsed: Final = urlparse(url)\n    if parsed.scheme != \"https\":\n        raise HTTPException(\n            status_code=400,\n            detail=\"Push notification URL must use HTTPS\",\n        )\n    try:\n        validate_url(url)\n    except (SSRFError, ValueError) as e:\n        raise HTTPException(status_code=400, detail=str(e)) from e\n\n\ndef _caller_identity_headers(user_api_key_dict: UserAPIKeyAuth) -> dict[str, str]:\n    headers: Final[dict[str, str]] = {}\n    if user_api_key_dict.user_id:\n        headers[\"X-LiteLLM-User-Id\"] = user_api_key_dict.user_id\n    if user_api_key_dict.team_id:\n        headers[\"X-LiteLLM-Team-Id\"] = user_api_key_dict.team_id\n    return headers\n\n","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/agent_endpoints/a2a_endpoints.py#L82-L118","documentation":"Raised by the push-notification config validation used by the A2A tasks/pushNotificationConfig/set handler when a supplied notification URL does not use the https scheme. A2A push destinations must be secure endpoints — an http:// webhook would leak auth tokens and task payloads in cleartext — so the JSON-RPC request is rejected with HTTP 400 before any config is stored.","triggerScenarios":"Thrown at litellm/proxy/agent_endpoints/a2a_endpoints.py:100 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an https:// push notification URL."],"exampleFix":"url='https://hooks.example.com/notify'","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}